What CISA Actually Added
CISA added four critical vulnerabilities to the Known Exploited Vulnerabilities catalog: CVE-2026-65400 in Apple macOS Screen Sharing, CVE-2026-55040 in Microsoft SharePoint, CVE-2026-59310 in Broadcom VMware vCenter, and CVE-2026-33824 in Microsoft Internet Key Exchange Service Extensions. All four now have the one label that matters most to defenders under time pressure: exploited in the wild.
The common lesson is not simply that four vendors shipped fixes. Each flaw sits on a different operational trust boundary. Screen Sharing touches endpoint and admin trust, SharePoint sits close to content and identity, vCenter controls virtualization infrastructure, and IKE lives in core Windows network services.
Why The vCenter And SharePoint Items Should Lead Triage
The SharePoint issue, CVE-2026-55040, is a weak-authentication flaw with a 9.1 CVSS score. The Hacker News notes that exploitation followed public proof-of-concept release, which means the problem is no longer whether Microsoft patched it in July. The real question is whether every exposed or weakly managed SharePoint instance was actually updated and checked for access before attackers arrived.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Free. Weekday mornings. Unsubscribe anytime.
Built from 100+ trusted cybersecurity sources.
The vCenter issue, CVE-2026-59310, is even more uncomfortable because it is a 9.8 path traversal bug that can lead to remote code execution. Reporting tied the exploitation to a suspected China-nexus actor deploying a backdoor, reverse SSH tooling, and in at least one case a Babuk-derived ransomware strain. The article cites 361 victim IPs across 47 countries, with the heaviest concentration in Germany, the United States, Turkey, Iran, and France. That is not niche testing. That is real campaign volume.
What The Apple And Microsoft IKE Flaws Tell You
CVE-2026-65400 in macOS Screen Sharing is an improper authentication flaw rated 9.8 that can let an attacker on the network authenticate without valid credentials. The exploitation context matters because it has been used to deliver a Monero miner, which tells defenders this is not just a theoretical remote-management bug. It is already being folded into operational monetization.
CVE-2026-33824 in Microsoft IKE Service Extensions is a 9.8 double-free vulnerability that Palo Alto Unit 42 says a Chinese-speaking actor exploited while also running AI-enabled autonomous attack activity. That detail matters because it connects a network-service bug to a broader attacker workflow, not just a one-off exploit test.
What To Verify First
Treat these four items as separate owner queues under one leadership priority.
- Find every exposed SharePoint, vCenter, macOS Screen Sharing deployment, and Windows service path tied to Microsoft IKE before debating patch-window etiquette.
- For SharePoint and vCenter, assume post-patch validation is as important as patch deployment because both products sit on high-trust administrative or content paths.
- Review recent authentication, admin, service-creation, and configuration activity on affected systems for signs that exploitation already moved from vulnerability into intrusion.
- If any vCenter or SharePoint asset is externally reachable and patch status is uncertain, escalate that uncertainty as an incident-risk problem, not routine maintenance debt.
- Brief infrastructure, collaboration, endpoint, and identity owners together so each team hears the full exposure picture instead of only its own product slice.
Source Context
CyberExperts used The Hacker News as the primary source and preserved the details that make the story useful: the exact CVEs, the active-exploitation status, the public PoC angle on SharePoint, the campaign scale around vCenter, and the concrete attacker outcomes tied to the Apple and Microsoft IKE flaws.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
